Add shop, POS sync, event ticketing, and shipping catalog apps (#6)

## Summary
- Closes #5
- Optional `shop`, `pos_sync`, `events`, and `shipping` apps gated by `FEATURE_*` flags
- Deps match the catalog: shop/events need email + Stripe; POS/shipping need shop
- Portal inventory, POS webhooks, capacity tickets, EasyPost/Pirate Ship shipping

## Test plan
- [ ] `manage.py test` (152 passed locally)
- [ ] Shop cart + paid order decrements stocked inventory
- [ ] POS inbound webhook decrements SKU; paid order queues outbound reserve
- [ ] Event capacity blocks overbook; paid order emails ticket codes
- [ ] Shipping stub label + Pirate Ship CSV of unshipped paid orders
- [ ] `validate-env.sh` rejects shop without email/payments, POS/shipping without shop

Reviewed-on: #6

.env.example

@@ -35,6 +35,10 @@ FEATURE_BLOG=true
 FEATURE_PAYMENTS=true
 FEATURE_SOCIAL=true
 FEATURE_SOCIAL_AI=true
+FEATURE_SHOP=true
+FEATURE_POS_SYNC=true
+FEATURE_EVENTS=true
+FEATURE_SHIPPING=true
 
 # reCAPTCHA (optional locally — form skips captcha when empty)
 RECAPTCHA_PUBLIC_KEY=
@@ -74,6 +78,21 @@ STRIPE_PUBLISHABLE_KEY=
 STRIPE_WEBHOOK_SECRET=
 STRIPE_CURRENCY=usd
 
+# Shop — FEATURE_SHOP (requires email/SMS + payments)
+# SHOP_PRINT_QUEUE_LIMIT_MINUTES=0
+
+# POS sync — FEATURE_POS_SYNC (requires shop). Required in beta/prod.
+POS_WEBHOOK_SECRET=
+POS_API_BASE_URL=
+POS_API_TOKEN=
+
+# Shipping — FEATURE_SHIPPING (requires shop). EasyPost optional; CSV export always works.
+EASYPOST_API_KEY=
+SHIP_FROM_LINE1=
+SHIP_FROM_CITY=
+SHIP_FROM_STATE=
+SHIP_FROM_ZIP=
+
 # Social — SOCIAL_TOKEN_ENCRYPTION_KEY required when FEATURE_SOCIAL=true
 # LinkedIn / Instagram App ID + Secret: Portal → Social accounts (not env).
 META_APP_ID=